Blockchain Papers

Alin-Ciprian ENIȚĂ

ROCYS is a knowledge resource for practitioners, scientists, and researchers working in various fields of cyber security, hacking, digital forensics, cyber warfare, viruses and worms domain or critical infrastructure protection area.

Alexandru Gabriel ANDREI

ROCYS is a knowledge resource for practitioners, scientists, and researchers working in various fields of cyber security, hacking, digital forensics, cyber warfare, viruses and worms domain or critical infrastructure protection area.

Roman Overko

In many smart contract architectures, every contract or object is mutably shared by default. The Sui smart contract platform bears the unique feature of distinguishing between shared and owned objects. While transactions operating on shared objects require consensus to sequence reads and writes, those involving only owned objects are independent and may bypass consensus; thus, the latter are less prone to this throughput bottleneck. However, it may not always be possible or desirable to avoid using shared objects. This article aims at identifying and investigating decentralized applications that require shared objects. Utilizing the Sui Rust SDK to query programmable transaction blocks, we analyze the frequency of transactions involving shared objects, shared resource contention levels, and most “popular” applications that contain shared objects. The presented results are reproducible and show the extensive usage of shared objects in Sui, low contention levels, and moderate dependency among shared objects in atomic transactions. This novel study of shared object use cases in a relatively new smart contract platform is important for improving the efficiency of such object-based architectures. This work is relevant for smart contract platform designers and smart contract developers.

Xiangzhen Wang

This article deeply explores the applications and impacts of blockchain technology and smart contracts in the financial industry. First, it outlines the basic principles and characteristics of blockchain technology and smart contracts, and then analyzes their application examples in various financial fields such as cross-border payments, supply chain finance, equity financing and securities issuance, and the insurance industry. The study found that blockchain technology and smart contracts bring significant changes and opportunities to the financial industry by improving transparency, reducing transaction costs, and enhancing security. However, the application of these technologies also faces challenges such as technological maturity, legal and regulatory perfection, and data privacy protection. This article aims to provide valuable references for practitioners, researchers, and policy makers in the financial industry to promote the widespread application and healthy development of blockchain technology and smart contracts in the financial industry.

Nasser Arshadi

This paper introduces blockchain-based smart contracts and Decentralized Autonomous Organizations (DAOs) as compelling alternatives to conventional corporate structures. Coase’s pioneering work in the 1930s posited that the decision to organize transactions within a firm hinges on whether it is more cost-effective than executing them in the open marketplace. However, if these transactions can be conducted more efficiently in the marketplace without the need for a traditional firm, that becomes the preferred approach. The advent of blockchain-based smart contracts, along with the adoption of numerous self-executing smart contracts, has the potential to significantly reduce the dependence on traditional firms. Coase’s theorem was contingent on the magnitude of transaction costs, and if smart contracts can substantially diminish these costs, facilitating the emergence of DAOs, the original rationale for forming a firm may no longer apply when considering the blockchain paradigm.

Valerian Callens, Zeeshan Meghji, Jan Gorzny

In this work we explore ways to restrict the ability to call Solidity smart contract functions for a specified duration. We describe methods to restrict functions from being called twice in the same transaction, block, or time period. This is related to the notion of non-reentrant functions, which are functions that can be called within a previous execution. These methods can be used to restrict interactions with entire sets of functions of smart contracts. We are motivated to revisit this topic for two reasons. First, we note that sixteen real-world smart contracts exploits in 2023 resulting in over $136M USD lost or stolen that could have been prevented by restricting function calls. As part of this survey, we dissect a new class of exploit that involves so-called read-only reentrancy: exploits that re-enter read-only functions to use smart contract state inconsistencies in order to enable their exploitation. Second, while some of these approaches are simple, they may not always behave the same across different blockchains that support Solidity.

Vilhelm Sjöberg, Kinnari Dave, Daniel Britten, Maria A. Schett · 9 authors

Programs executed on a blockchain - smart contracts - have high financial stakes; their correctness is crucial. We argue, that this correctness needs to be foundational: correctness needs to be based on the operational semantics of their execution environment. In this work we present a foundational system - the DeepSEA system - targeting the Ethereum blockchain as the largest smart contract platform. The DeepSEA system has a small but sufficiently rich programming language amenable for verification, the DeepSEA language, and a verified DeepSEA compiler. Together they enable true end-to-end verification for smart contracts. We demonstrate usability through two case studies: a realistic contract for Decentralized Finance and contract for crowdfunding.

Suhyeon Lee, Euisin Gee, Jung­hee Lee

Verifiable Delay Function (VDF) is a cryptographic concept that ensures a minimum delay before output through sequential processing, which is resistant to parallel computing. One of the significant VDF protocols academically reviewed is the VDF protocol proposed by Pietrzak. However, for the blockchain environment, the Pietrzak VDF has drawbacks including long proof size and recursive protocol computation. In this paper, we present an implementation study of Pietrzak VDF verification on Ethereum Virtual Machine (EVM). We found that the discussion in the Pietrzak's original paper can help a clear optimization in EVM where the costs of computation are predefined as the specific amounts of gas. In our results, the cost of VDF verification can be reduced from 4M to 2M gas, and the proof length can be generated under 8 KB with the 2048-bit RSA key length, which is much smaller than the previous expectation.

Dr.Karthick. M, N Anusri, Nithish kumar P, P Siva · 5 authors

Agriculture sector plays a pivotal role in the Indian economy, but farmers often face challenges like unpredictable weather, pest attacks, and erratic rainfall, leading to significant losses.Crop insurance is crucial to mitigate these risks and coverage for pre-sowing and post-harvest losses due to natural calamities.Block-chain based insurance system for farmers with smart contracts.The system is designed to provide farmers with insurance coverage against crop failure due to natural disasters.The system uses smart contract to automatically calculate and pay out insurance claims to farmers based on data from the weather cloud app.This approach involves using block-chain technology to create a decentralized and immutable ledger that records all insurance contracts, claims, and payouts.This system could greatly benefit farmers by providing them with more reliable and timely financial support in the event of adverse weather conditions or crop failures, thereby reducing their risk and encouraging greater investment in crop production.The crop index insurance is based on objectively measurable and verifiable data (e.g., weather data, satellite imagery) to determine insurance payouts, thus minimizing the need for on-the-ground assessments and reducing the risk of fraudulent claims.Furthermore, the model includes a decentralized application (DApp) interface for stakeholders to interact with the insurance policies seamlessly, view realtime data, and monitor the status of their coverage and claims.The utilization of Ethereum and Polygon networks ensures the scalability, sustainability, and accessibility of this solution, paving the way for a more resilient agricultural sector.

Massimo Bartoletti, Angelo Ferrando, E. Lipparini, Vadim Malvone

Smart contracts are an attractive target for attackers, as evidenced by a long history of security incidents. A current limitation of smart contract verification tools is that they are not really effective in expressing and verifying liquidity properties regarding the exchange of crypto-assets: for example, is it true that in every reachable state a user can fire a sequence of transactions to withdraw a given amount of crypto-assets? We propose Solvent, a tool aimed at verifying these kinds of properties, which are beyond the reach of existing verification tools for Solidity. We evaluate the effectiveness and performance of Solvent through a common benchmark of smart contracts.

Thi-Nhung Nguyen

Blockchain technology is a revolutionary concept that has transformed various industries, offering decentralized and secure solutions for data management. At its core, a blockchain is a distributed and immutable ledger that records transactions across a network of computers. One of the key features of blockchain is its transparency, as each participant in the network has access to the same information. The application of blockchain technology extends across diverse sectors, with finance being the most promising and well-known application domain. Cryptocurrencies, like Bitcoin and Ethereum, rely on blockchain to facilitate secure and transparent transactions. The decentralized nature of blockchain eliminates the need for intermediaries, reducing transaction costs and increasing efficiency. Beyond finance, blockchain is making significant strides in supply chain management. The emergence of blockchain technology has paved the way for a transformative innovation in the realm of digital transactions: smart contracts. These self-executing contracts encoded in blockchain have garnered significant attention for their potential to revolutionize the way agreements are made, executed, and enforced. This paper explores the concept of smart contracts, delving into the underlying technology, finding applications across various industries, legal implications, and future prospects.

Zhiyang Chen, Ye Liu, Sidi Mohamed Beillahi, Yi Li · 5 authors

Smart contract transactions associated with security attacks often exhibit distinct behavioral patterns compared with historical benign transactions before the attacking events. While many runtime monitoring and guarding mechanisms have been proposed to validate invariants and stop anomalous transactions on the fly, the empirical effectiveness of the invariants used remains largely unexplored. In this paper, we studied 23 prevalent invariants of 8 categories, which are either deployed in high-profile protocols or endorsed by leading auditing firms and security experts. Using these well-established invariants as templates, we developed a tool Trace2Inv which dynamically generates new invariants customized for a given contract based on its historical transaction data. We evaluated Trace2Inv on 42 smart contracts that fell victim to 27 distinct exploits on the Ethereum blockchain. Our findings reveal that the most effective invariant guard alone can successfully block 18 of the 27 identified exploits with minimal gas overhead. Our analysis also shows that most of the invariants remain effective even when the experienced attackers attempt to bypass them. Additionally, we studied the possibility of combining multiple invariant guards, resulting in blocking up to 23 of the 27 benchmark exploits and achieving false positive rates as low as 0.32%. Trace2Inv outperforms current state-of-the-art works on smart contract invariant mining and transaction attack detection in terms of both practicality and accuracy. Though Trace2Inv is not primarily designed for transaction attack detection, it surprisingly found two previously unreported exploit transactions, earlier than any reported exploit transactions against the same victim contracts.

Janhavi Satam

Objective: By reviewing various previous works, this paper collects the multiple of approaches, strategies used to identify vulnerabilities in smart contracts. Blockchain is a decentralized technology that securely and immutably, records transactions across numerous computers in a visible manner. On a blockchain, smart contracts are self-executing agreements that independently execute and verify contract conditions. This reduces the need for middlemen and increases transparency. Smart contract vulnerabilities are problems in the code that could allow other parties to gain access to, alter, or steal assets as a result of mistakes, faults or imperfections made during development, thereby causing financial and operational harm. In this paper we have algorithms, techniques to detect vulnerabilities in smart contract using deep learning found in literature surveys. Methods: We have found some techniques using opcode, bytecode, Skip-Gram-Word2Vec to convert the smart contract file. Findings: We have found that LSTM, Vanilla-RNN, GRU have very less accuracy 49.64,53.68,54.54. Novelty & Applications: We will come with some different algorithms that will understand different vulnerability with more accuracy. We have come with CNN, Xception, EfficientNet-B2 which has accuracy high then LSTM, Vanilla-RNN, GRU i.e.71,69,75 percent.

Erhan Daştan, Hüseyin Dağlı

The aim of this study is to examine whether the assets known as safe-haven assets during crises fulfill these qualities for equity investors in Turkey during the Covid-19 pandemic. According to the results obtained under the assumption of GJR-GARCH (1,1) error terms, no asset has shown safe-haven characteristics against the stock market. However, when the BIST100 index depreciates by 5%, Ethereum, silver and Government Bonds show strong safe-haven characteristics, US dollar and Euro show weak safe-haven characteristics. When the BIST100 index depreciates by 2.5%, Bitcoin, gold and DJIMTR show weak safe haven asset characteristics. If BIST100 depreciates by 1%, gold and Government Bonds show strong safe-haven characteristics, and Bitcoin, Ethereum, Silver, the US dollar and Euro show weak safe-haven characteristics.

S. Arunprasath, A. Suresh

Information and communication technology based inter-organizational systems enable companies to integrate information and conduct business electronically across different parts of the organization. For organizations embracing blockchain, smart contracts provide automation and operational efficiency for inter-organizational systems. Initially utilised for financial transactions, smart contract are extended beyond banking and deployed in wide number of organizations. Smart contracts are regarded as self-executing type of contract consisting of agreement’s terms embedded directly into the code which plays a vital role in operability for inter-organizational systems, however, smart contract vulnerabilities can arise due to programming errors, leading to security issues. The effects of smart contract vulnerabilities can be significant, including loss of funds, unauthorized access to sensitive information, manipulation of data, and loss of trust in the application leading to catastrophic financial losses followed by legal implications for an organization based on blockchain technology. The goal of smart contracts exploiting vulnerabilities is to discover and eliminate potential security vulnerabilities in smart contract code prior to it being deployed. Detecting vulnerabilities in a timely manner helps to prevent financial losses, unauthorized access, and data manipulation. In order to provide a robust solution to detect vulnerabilities in smart contracts, the proposed methodology presents a novel approach for rapid detection of vulnerabilities by integrating genetic algorithm with isolation forest. Furthermore, enhancing smart contract vulnerability identification with higher accuracy and false-positive rate provides a reliable gateway for organizations to adopt blockchain.

Wei Ma, Daoyuan Wu, Yuqiang Sun, Tianwen Wang · 8 authors

Smart contracts are decentralized applications built atop blockchains like Ethereum. Recent research has shown that large language models (LLMs) have potential in auditing smart contracts, but the state-of-the-art indicates that even GPT-4 can achieve only 30% precision (when both decision and justification are correct). This is likely because off-the-shelf LLMs were primarily pre-trained on a general text/code corpus and not fine-tuned on the specific domain of Solidity smart contract auditing. In this paper, we propose iAudit, a general framework that combines fine-tuning and LLM-based agents for intuitive smart contract auditing with justifications. Specifically, iAudit is inspired by the observation that expert human auditors first perceive what could be wrong and then perform a detailed analysis of the code to identify the cause. As such, iAudit employs a two-stage fine-tuning approach: it first tunes a Detector model to make decisions and then tunes a Reasoner model to generate causes of vulnerabilities. However, fine-tuning alone faces challenges in accurately identifying the optimal cause of a vulnerability. Therefore, we introduce two LLM-based agents, the Ranker and Critic, to iteratively select and debate the most suitable cause of vulnerability based on the output of the fine-tuned Reasoner model. To evaluate iAudit, we collected a balanced dataset with 1,734 positive and 1,810 negative samples to fine-tune iAudit. We then compared it with traditional fine-tuned models (CodeBERT, GraphCodeBERT, CodeT5, and UnixCoder) as well as prompt learning-based LLMs (GPT4, GPT-3.5, and CodeLlama-13b/34b). On a dataset of 263 real smart contract vulnerabilities, iAudit achieves an F1 score of 91.21% and an accuracy of 91.11%. The causes generated by iAudit achieved a consistency of about 38% compared to the ground truth causes.

Zexu Wang, Jiachi Chen, Yanlin Wang, Yu Zhang · 6 authors

Reentrancy vulnerability as one of the most notorious vulnerabilities, has been a prominent topic in smart contract security research. Research shows that existing vulnerability detection presents a range of challenges, especially as smart contracts continue to increase in complexity. Existing tools perform poorly in terms of efficiency and successful detection rates for vulnerabilities in complex contracts. To effectively detect reentrancy vulnerabilities in contracts with complex logic, we propose a tool named SliSE. SliSE’s detection process consists of two stages: Warning Search and Symbolic Execution Verification . In Stage I, SliSE utilizes program slicing to analyze the Inter-contract Program Dependency Graph (I-PDG) of the contract, and collects suspicious vulnerability information as warnings. In Stage II, symbolic execution is employed to verify the reachability of these warnings, thereby enhancing vulnerability detection accuracy. SliSE obtained the best performance compared with eight state-of-the-art detection tools. It achieved an F1 score of 78.65%, surpassing the highest score recorded by an existing tool of 9.26%. Additionally, it attained a recall rate exceeding 90% for detection of contracts on Ethereum. Overall, SliSE provides a robust and efficient method for detection of Reentrancy vulnerabilities for complex contracts.

Francesco Salzano, Simone Scalabrino, Rocco Oliveto, Remo Pareschi

Smart Contracts are programs running logic in the Blockchain network by executing operations through immutable transactions. The Blockchain network validates such transactions, storing them into sequential blocks of which integrity is ensured. Smart Contracts deal with value stakes, if a damaging transaction is validated, it may never be reverted, leading to unrecoverable losses. To prevent this, security aspects have been explored in several fields, with research providing catalogs of security defects, secure code recommendations, and possible solutions to fix vulnerabilities. In our study, we refer to vulnerability fixing in the ways found in the literature as guidelines. However, it is not clear to what extent developers adhere to these guidelines, nor whether there are other viable common solutions and what they are. The goal of our research is to fill knowledge gaps related to developers' observance of existing guidelines and to propose new and viable solutions to security vulnerabilities. To reach our goal, we will obtain from Solidity GitHub repositories the commits that fix vulnerabilities included in the DASP TOP 10 and we will conduct a manual analysis of fixing approaches employed by developers. Our analysis aims to determine the extent to which literature-based fixing strategies are followed. Additionally, we will identify and discuss emerging fixing techniques not currently documented in the literature. Through qualitative analysis, we will evaluate the suitability of these new fixing solutions and discriminate between valid approaches and potential mistakes.

Giacomo Ibba, Giuseppe Destefanis, Rumyana Neykova, Marco Ortu · 6 authors

The growing importance of Decentralized Applications (dApps) in areas such as the Internet of Things (IoT), Cybersecurity, and Finance is playing a crucial role in advancing software maintenance, security, and data sharing. Understanding the complex architecture and components of dApps is essential to harness their full benefits. This often involves the challenging task of identifying and retrieving key components during the dApp compilation process, particularly when dealing with multiple external dependencies. A case in point is the variety of versions in the OpenZeppelin libraries, where finding compatible elements can be a laborious process. In response to this challenge, we introduce DAI (Dependency Analyser and Installer), a novel tool that automates the identification of compatible external dependency versions for specific smart contracts. This tool significantly simplifies the compilation process for dApps that incorporate external modules, making it more efficient for developers and researchers. We evaluated DAI on 57 real-world dApps, achieving success in determining the right dependency match for 50 cases. However, the inability to compile the remaining 7 dApps due to missing files and artifacts highlights the ongoing complexities in dApp development.

Fatima Zahra Meskini, Rajae Aboulaïch

We surveyed to measure the satisfaction of policyholders in Morocco, and the results clearly show that the majority of customers do not appreciate the current services. They suffer from the ambiguity of contracts, and delays in reimbursement and do not feel the real impact of insurance in society. To solve this problem, we propose an innovative insurance based on blockchain and waqf. We suggest in this paper, to use smart contracts to create an efficient and automatic process in the collection of premiums and reimbursement of policyholders. The goal of this paper is to build insurance that reflects the true meaning of solidarity through Waqf while integrating transparency and speed through Fintech. This insurance model is supposed to be resilient in times of crisis, have a strong social impact, and be attractive to customers. Many advantages of the proposed model are discussed in the paper. In addition, the suggested insurance model will be represented through simulations on the NetLogo platform. We carry out the analysis in normal times and evaluate the behavior of policyholders in choosing a specific type of insurance, depending on some decision-making tools. We also analyze the impact of insurance during a time of crisis, as a particular example, the crisis experienced during the coronavirus pandemic. The simulations aim to evaluate the model in different situations and prove its efficiency.

Zexu Wang, Jiachi Chen, Peilin Zheng, Yu Zhang · 6 authors

Reentrancy is one of the most notorious vulnerabilities in smart contracts, resulting in significant digital asset losses. However, many previous works indicate that current Reentrancy detection tools suffer from high false positive rates. Even worse, recent years have witnessed the emergence of new Reentrancy attack patterns fueled by intricate and diverse vulnerability exploit mechanisms. Unfortunately, current tools face a significant limitation in their capacity to adapt and detect these evolving Reentrancy patterns. Consequently, ensuring precise and highly extensible Reentrancy vulnerability detection remains critical challenges for existing tools. To address this issue, we propose a tool named ReEP, designed to reduce the false positives for Reentrancy vulnerability detection. Additionally, ReEP can integrate multiple tools, expanding its capacity for vulnerability detection. It evaluates results from existing tools to verify vulnerability likelihood and reduce false positives. ReEP also offers excellent extensibility, enabling the integration of different detection tools to enhance precision and cover different vulnerability attack patterns. We perform ReEP to eight existing state-of-the-art Reentrancy detection tools. The average precision of these eight tools increased from the original 0.5% to 73% without sacrificing recall. Furthermore, ReEP exhibits robust extensibility. By integrating multiple tools, the precision further improved to a maximum of 83.6%. These results demonstrate that ReEP effectively unites the strengths of existing works, enhances the precision of Reentrancy vulnerability detection tools.

Yulin Shen, LI Xiao-fu

Although there is currently no Bitcoin futures trading in Chinese Mainland, there is the possibility of financial innovation in future.The success or failure of the U.S. Bitcoin futures trading was analyzed from an empirical perspective: Regulators replace active review with self-certification, and Bitcoin futures trading violates the law of one price, both of which are prone to financial risks.Bitcoin futures break through previous government barriers that largely separated the virtual currency market from the regulated financial system.Although it has a positive role in integrating the virtual currency market with the broader financial system, it is not recommended for Chinese domestic use in the near future.The futures contract market listed by exchanges should be contracts that are not easily manipulated.In the future, domestic Bitcoin futures trading should emphasize legal regulations and technical support and strengthen the approval process before new products are launched.

Mario Iván Contreras-Valdez, Sonal Sahu, José Antonio Núñez Mora, Roberto J. Santillán‐Salgado

In the broader landscape of cryptocurrency risk management, this study delves into the nuanced estimation of Value-at-Risk (VaR) for a uniformly weighted portfolio of cryptocurrencies, employing the bivariate Normal Inverse Gaussian distribution renowned for its semi-heavy tails. Utilizing high-frequency data spanning between 1 January 2017 and 25 October 2022, with a primary focus on Bitcoin and Ethereum, our research seeks to accentuate the resilience of VaR methodology as a paramount risk assessment tool. The essence of our investigation lies in advancing the comprehension of VaR accuracy by quantitatively comparing the observed returns of both cryptocurrencies with their corresponding estimated values, with a central theme being the endorsement of the Normal Inverse Gaussian distribution as a potent model for risk measurement, particularly in the domain of high-frequency data. To bolster the statistical reliability of our results, we adopt a forward test methodology, showcasing not only a contribution to the evolution of risk assessment techniques in Finance but also underscoring the practicality of sophisticated distributional models in econometrics. Our findings not only contribute to the refinement of risk assessment methods but also highlight the applicability of such models in precisely modeling and forecasting financial risk within the dynamic realm of cryptocurrencies, epitomized by the case study of Bitcoin and Ethereum.

Xinyan Jiang

No abstract is available for this record.